CVE-2026-124509
Deferred Deferred - Pending Action

Path Traversal in Floci S3 Destination Configuration

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulDB

Description
A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-124509
EUVD
EUVD-2026-119770

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
floci-io floci to 2.2.0 (exc)
floci-io floci 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in Floci up to version 2.1.0. It occurs in the S3Destination.bucketName function where manipulation of the BucketARN argument allows escaping the intended storage directory. Specifically, bucket names like .versions and .annotations collide with Floci's internal reserved directories, enabling unintended access to other buckets' data or versioned objects.

Detection Guidance

Check Floci version with 'floci --version' or inspect the services/firehose/model/DeliveryStreamDescription.java file for the S3Destination.bucketName function. Look for bucket names containing reserved paths like '.accounts', '.versions', or '.annotations' in S3 configurations.

Impact Analysis

An attacker could exploit this to overwrite or read versioned objects from other buckets, access annotation data, or corrupt stored files. This could lead to data leaks, unauthorized modifications, or service disruptions if sensitive data is exposed or altered.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR requires protecting personal data, while HIPAA mandates securing health information. Exploitation could lead to breaches, resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Floci to version 2.2.0 or later. Review S3 bucket names for reserved terms (.accounts, .versions, .annotations) and remove or rename them. Ensure no legacy buckets use these names to prevent path traversal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...